CVE-2025-21796

CVE-2025-21796 is a Linux kernel use-after-free vulnerability in nfsd where acl_access/acl_default could retain a pointer to a released posix_acl, enabling a UAF scenario. The fix is to clear acl_access/acl_default after releasing them to prevent the use-after-free. Public advisories (e.g., ALAS2...

CVE-2016-2117

CVE-2016-2117 affects the Atheros L2 ethernet driver (atl2) in the Linux kernel up to version 4.5.2. The root cause is incorrect enablement of scatter/gather I/O, which can allow a remote attacker to read packet data and potentially obtain sensitive kernel memory information. Public documents fro...

CVE-2018-10124

CVE-2018-10124 affects the Linux kernel before 4.13, where the kill_something_info() function in kernel/signal.c may allow a local attacker to cause a denial of service via an INT_MIN argument when using an unspecified architecture and compiler. The vulnerability is a local DoS condition (availab...

CVE-2019-18885

CVE-2019-18885 affects the Linux kernel (fs/btrfs/volumes.c) with a NULL pointer dereference in btrfs_verify_dev_extents when processing a crafted btrfs image. Root cause: fs_devices->devices is mishandled in find_device, enabling NULL dereferences in btrfs_verify_dev_extents. Impact per publi...

CVE-2021-3411

CVE-2021-3411 describes a memory access violation in the Linux kernel prior to 5.10, caused by a padding int3 check during linking. The flaw can affect data confidentiality, integrity, and system availability. A Nessus Unity Linux advisory references this vulnerability (UTSA-2026-004638) and reit...

CVE-2021-47495

CVE-2021-47495 involves the Linux kernel usbnet vulnerability where a zero maxpacket caused an invalid division and a kernel oops. The description notes a sanity check for maxpacket and that a 0 value is nonsensical, leading to a failure to divide by it. The accompanying notes indicate a fix was ...

CVE-2023-1637

CVE-2023-1637 affects the Linux kernel X86 CPU Power Management options, described as a speculative-execution style vulnerability in suspend-to-RAM resume. Connected advisories (e.g., ALAS-2024-076 and related Nessus/Amazon/Linux entries) confirm the issue is a local-privilege/information disclos...

CVE-2023-52672

CVE-2023-52672 affects the Linux kernel pipe handling code. A regression in pipe resizing caused writers to deadlock when a pipe was full during a resize because wakeups on pipe->wr_wait could occur before pipe->max_usage was updated. The fix changes the sequence: set max_usage (and nr_acco...

CVE-2023-52707

CVE-2023-52707: Linux kernel sched/psi use-after-free in ep_remove_wait_queue() can occur when a non-root cgroup is removed while a thread is polling a pressure file; the polling thread may access a freed waitqueue during file close/exit, causing a use-after-free. The issue is rooted in cgroup_fi...

CVE-2023-52775

CVE-2023-52775 is a Linux kernel vulnerability affecting net/smc where a Decline message could cross or collide in SMC-R, causing data corruption during Redis/SRC testing. A patch doubles the client timeout to 2x the server value to prevent cross‑timeout conflicts; remediation is upgrading to a k...

CVE-2023-52800

The CVE-2023-52800 entry concerns a Linux kernel issue in wifi/ath11k: the htt pktlog handling calling ath11k_mac_get_ar_by_pdev_id() was not in an RCU read-side critical section. The fix marks that code path as an RCU read-side critical section to prevent potential use-after-free in ath11k activ...

CVE-2024-0582

The CVE-2024-0582 issue affects the Linux kernel io_uring subsystem, specifically the IORING_REGISTER_PBUF_RING path where a user registers, mmaps, and frees a buffer ring. The vulnerability is a memory leak that can be exploited by a local user to crash the system or potentially escalate privile...

CVE-2024-26629

CVE-2024-26629: Linux kernel nfsd: fix RELEASE_LOCKOWNER. Connected advisories document a patch correcting a test on so_count in nfsd4_release_lockowner(), which could transiently report locks held and cause NFS4 errors. The fix reverts to check_for_locks() (made to not sleep) and prevents false ...

CVE-2024-26691

CVE-2024-26691 affects Linux kernel KVM for arm64. The circular locking arises when pkvm_create_hyp_vm() acquires kvm->lock while kvm_vcpu_ioctl() holds vcpu->mutex. The fix is to protect the hyp VM handle with config_lock (instead of keeping the vcpu->mutex under kvm->lock), mitigati...

CVE-2024-26883

CVE-2024-26883 : In the Linux kernel, a vulnerability was fixed that affects 32-bit architectures in the stackmap handling used by BPF. The overflow risk arises when roundup_pow_of_two() is used to compute the number of hash buckets, as a 32‑bit left shift can overflow and cause undefined behavio...

CVE-2024-26930

CVE-2024-26930 : In the Linux kernel, the SCSI/QLA2xxx double-free vulnerability occurs when ha->vp_map is freed twice (in qla2x00_mem_alloc and again in qla2x00_mem_free). The root cause is a use-after-free-like double free of ha->vp_map; the fix assigns NULL to vp_map and lets kfree handl...

CVE-2024-36028

CVE-2024-36028: Linux kernel mm/hugetlb vulnerability fixed. The issue caused DEBUG_LOCKS_WARN_ON(1) during dissolve_free_hugetlb_folio(), leading to a kernel warning and panic. Connected sources attribute the root cause to a field packing problem where folio.deferred is unioned with folio._huget...

CVE-2024-36891

CVE-2024-36891 : Linux kernel issue in maple_tree where mas_start() could yield a NULL maple node and later dereference in mas_data_end(), potentially causing a kernel oops if a user unmapps all VMA regions and re-maps a VMA to recreate the empty maple tree. The fix prevents writing offsets when ...

CVE-2024-36950

CVE-2024-36950 is a Linux kernel vulnerability resolved in the FireWire OHCI driver. The issue occurred in the interrupt handler when a bus reset interrupt could be unmasked and cause a freeze if the bus reset was not yet serviced. The fix masks bus reset interrupts in the IRQ handler and unmasks...

CVE-2024-40912

CVE-2024-40912 – Linux kernel (wifi/mac80211) deadlock fix. The issue arises in ieee80211_sta_ps_deliver_wakeup() where sta->ps_lock is taken with a non-IRQL-safe spin_lock(), allowing softirq to run on the same CPU and contend with ieee80211_tx_h_unicast_ps_buf(), creating a deadlock (RCU sta...

CVE-2024-40978

CVE-2024-40978 affects the Linux kernel, specifically a qedi/scsi path vulnerability. The root cause is qedi_dbg_do_not_recover_cmd_read() calling sprintf() on a __user pointer, which can crash the kernel. The fix uses a small local stack buffer for sprintf() and then copies with simple_read_from...

CVE-2024-41039

CVE-2024-41039 (Linux kernel) : The vulnerability is resolved by fixing overflow checks when parsing wmfw headers in firmware handling. The patch splits the length check into three separate verifications for wmfw_header, wmfw_adsp?_sizes, and wmfw_footer, addressing cases where ADSP2 and Halo Cor...

CVE-2024-42304

CVE-2024-42304 (Linux kernel ext4) : The vulnerability arises when the first directory block is a hole in non-inline directories, causing ext4_read_dirblock to mis-handle a hole read and potentially crash code that relies on "." and "..". The fix prevents loading corrupted data by reporting files...

CVE-2024-46725

CVE-2024-46725 refers to a Linux kernel vulnerability where the drm/amdgpu path could trigger an out-of-bounds write warning. The connected Astra Linux bulletin confirms the issue as a kernel-level flaw and notes the fix was to validate the ring type value to prevent the OOB write. The vulnerabil...

CVE-2024-47660

CVE-2024-47660 : Linux kernel fsnotify race causing lock contention. When removing watches on a directory with many dentries, __fsnotify_update_child_dentry_flags() races with __fsnotify_parent() on children, risking softlockup reports. The fix, per the bulletin, is to set PARENT_WATCHED only whe...

CVE-2024-47706

CVE-2024-47706 affects the Linux kernel bfq I/O scheduler. The issue was a use-after-free involving bfqq->bic during merges in the bfq_merge/merge-chain flow, which could allow IO handling to operate on a bfqq that is no longer valid. The provided details describe an initial state with three b...

CVE-2024-47739

CVE-2024-47739 concerns the Linux kernel padata subsystem. The vulnerability arises when submitting more than 2^32 padata objects to padata_do_serial, where the sorting of overflowed seq_nr values can cause a newly overflowed entry to be placed before existing ones, leading to a deadlock in the s...

CVE-2024-49851

The CVE CVE-2024-49851 affects the Linux kernel TPM subsystem. The vulnerability originated from tpm_dev_transmit preparing TPM space before transmission and not rolling back this preparation if a command fails, potentially leaking transient TPM handles when the device is closed afterwards. The p...

CVE-2024-49935

CVE-2024-49935 involves the Linux kernel ACPI PAD path (exit_round_robin) where a crash can occur in cpumask_clear_cpu() due to clear_bit(nr) with nr = 0xffffffff and misaligned memory access. The fixed issue, as documented, is to validate tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_...

CVE-2024-53063

The CVE-2024-53063 issue affects the Linux kernel’s media/dvb-core/dvbdev.c. It centers on a static variable that stores DVB minors and behavior that depends on CONFIG_DVB_DYNAMIC_MINORS. When the dynamic-minors feature is not set, dvb_register_device() may not enforce boundaries because it relie...

CVE-2024-53066

CVE-2024-53066 describes a KMSAN warning in the Linux kernel’s NFS getattr decoding path. The issue arises from an uninitialized fattr->mdsthreshold field in decode_getfattr_attrs()/decode_attr_mdsthreshold(), which could trigger a KMSAN failure. The provided fix initializes fattr->mdsthres...

CVE-2024-53136

In CVE-2024-53136, the Linux kernel mm/shmem fix was reverted: reverting the patch that fixed data-race in shmem_getattr() to address deadlocks when accessing tmpfs over NFS. The description notes the revert was done at d949d1d14fa2 per guidance, with comments indicating the change silenced a syz...

CVE-2024-53213

CVE-2024-53213 – Linux kernel (LAN78xx USB Ethernet driver) Connected sources confirm a concrete issue in lan78xx where a buffer allocated in lan78xx_probe() was freed twice: once via usb_free_urb(dev->urb_intr) with URB_FREE_BUFFER and again by kfree(buf). The root cause is the double free st...

CVE-2024-53222

Concretely, CVE-2024-53222 affects Linux zram: the zram_add() path can dereference NULL for zram->comp_algs[ZRAM_PRIMARY_COMP] if comp_algorithm_set() hasn’t run yet. The fix moves the necessary setup earlier (ahead of device_add_disk()) so the zram device is ready before users can access it v...

CVE-2024-56603

CVE-2024-56603 affects the Linux kernel in the net/af_can path. On error in can_create(), the code frees the allocated sk object, but sock_init_data() had already attached it to the sock, leaving a dangling sk pointer and introducing a potential use‑after‑free. The connected advisories confirm a ...

CVE-2024-58072

CVE-2024-58072 corresponds to a Linux kernel issue in the rtlwifi subsystem. The fix removes an unused private-data hook (check_buddy_priv) and related data structures that were added to a global private data list. The description states the list and lock were unused and could lead to access of f...

CVE-2025-21692

Summary: CVE-2025-21692 affects the Linux kernel net/sched ETS Qdisc, where ets_class_from_arg() can index an out-of-bounds ets_class when clid is 0, leading to an Out-Of-Bounds condition and potential local privilege escalation. The vulnerability is demonstrated in the provided trace and is link...

CVE-2025-21744

CVE-2025-21744 affects the Linux kernel brcmfmac wifi driver. On device removal or module unload, a sequence including brcmf_detach, brcmf_remove_interface, brcmf_del_if, and brcmf_proto_detach can lead to a NULL return from brcmf_get_ip() and a subsequent NULL pointer dereference inside brcmf_tx...

CVE-2025-21846

CVE-2025-21846 (Linux kernel) : The acct(2) path could trigger a NULL dereference when writing to a file that triggers an internal lookup (e.g., /sys/power/resume) after the task has exited. The fix reorganizes the code so the final write executes from a workqueue while preserving the caller’s cr...

CVE-2025-21991

The CVE-2025-21991 issue affects the Linux kernel’s AMD microcode loader for x86. It could trigger an out-of-bounds access when iterating NUMA nodes with empty or CPU-less nodes, potentially accessing cpu_data beyond its bounds during a microcode update. The root cause is that load_microcode_amd(...

CVE-2022-1973

CVE-2022-1973 describes a use-after-free in the Linux kernel NTFS3 filesystem, specifically in the log_replay path (fs/ntfs3/fslog.c). It allows a local attacker to crash the system and may lead to kernel information leakage. The connected Astra Linux note corroborates the same description of the...

CVE-2022-49316

CVE-2022-49316 affects the Linux kernel’s NFSv4 layout management. The issue arises when performing layoutget as part of an open() compound: locks for the layoutget are held across multiple RPC calls, which can trigger recalls and deadlock. The connected advisories (EulerOS/Unity/Nessus OSS) conf...

CVE-2022-49328

CVE-2022-49328 is a vulnerability in the Linux kernel mt76 driver where a use-after-free can occur in mt76_txq_schedule due to an unprotected wcid pointer (non-RCU). The issue is addressed by guarding the mtxq->wcid with an rcu_lock between mt76_txq_schedule and sta_info_alloc/free, per the re...

CVE-2022-49429

CVE-2022-49429 affects the Linux kernel’s RDMA/hfi1 subsystem. When the hfi1 module is loaded with SDMA disabled (HFI1_CAP_SDMA off), a call to hfi1_write_iter() can dereference a NULL pointer, causing a kernel panic through the I/O path (sdma_select_user_engine → hfi1_user_sdma_process_request →...

CVE-2023-26607

CVE-2023-26607 affects the Linux kernel, with an out-of-bounds read in ntfs_attr_find (fs/ntfs/attrib.c) reported for kernel 6.0.8. The connected documents confirm the issue and align on the impacted component and root cause, but do not provide a vendor/product patch version or explicit remediati...

CVE-2023-38426

The CVE-2023-38426 issue affects the Linux kernel prior to 6.3.4, specifically ksmbd’s SMB2 path where an out-of-bounds read occurs in smb2_find_context_vals if create_context’s name_len exceeds the tag length. Public references (kernel commit and ChangeLog-6.3.4) confirm the vulnerability contex...

CVE-2023-52662

The CVE-2023-52662 issue affects the Linux kernel DRM vmwgfx path: a memleak in vmw_gmrid_man_get_node when ida_alloc_max fails, where resources allocated prior (including kmalloc‑allocated memory and ttm_resource_init structures) were not freed. The connected Astra/Tenable entries corroborate th...

CVE-2023-52762

CVE-2023-52762 — Linux kernel virtio-blk overflow in max DMA size Root cause: In virtio-blk, an implicit conversion from size_t to u32 occurs when assigning (u32)max_size = (size_t)virtio_max_dma_size(vdev); If virtio_max_dma_size(vdev) returns a value larger than U32_MAX, the cast to u32 yields ...

CVE-2024-35843

The CVE concerns the Linux kernel IOMMU VT-d path for I/O page fault reporting. The fix replaces pci_get_domain_bus_and_slot() with device_rbtree_find() to locate the target PCI device within the probed device rbtree, reducing search overhead. The I/O page fault is initiated by the device and cur...

CVE-2024-35957

The CVE-2024-35957 vuln in the Linux kernel/IOMMU VT-d path arises from probing code that tracked all probed devices in an rbtree by source ID, assuming uniqueness that VT-d does not guarantee. The fix, per the linked advisories, is to only track devices that have PCI ATS capabilities in the iomm...